Security

qte77-claude-code-utils Skill

Detect hardcoded secrets, API keys, tokens, and credentials in code and git history. Use when auditing for leaked secrets or before publishing code.

qte77-claude-code-utils Bundle

Audit and tighten codebase quality gates — architecture, lint, types, tests, docs, code review. Use when onboarding a project, before a release, or when validation is too permissive.

qte77-claude-code-utils Skill

Scan project dependencies for vulnerabilities, license issues, and supply chain risks. Use when auditing third-party packages or before releases.

qte77-claude-code-utils Skill

Audit code against OWASP Top 10 vulnerabilities with structured findings. Use when reviewing code for security issues or conducting security audits.

qte77-claude-code-utils Skill

Audit documentation against its declared hierarchy — broken links, duplicates, misplaced content, stale references, single-source-of-truth enforcement. Use for doc health reviews.

qte77-claude-code-utils Bundle

Verify an external or AI-generated security report against the actual codebase before acting on it. Use when handed a scanner PDF, automated teardown, audit report, or bug-bounty submission — classifies every finding CONFIRMED / OVERSTATED / FALSE-POSITIVE / FABRICATED and salvages the real work items.

qte77-claude-code-utils Skill

Audits website usability for UX optimization, covering forms, navigation, validation, and microcopy. Use when reviewing user experience, task completion flows, or interface friction points.

davidortinau Bundle

Add secure storage to .NET MAUI apps using SecureStorage.Default. Covers SetAsync, GetAsync, Remove, RemoveAll, platform setup (Android backup rules, iOS Keychain entitlements, Windows limits), common pitfalls, and a DI wrapper service for testability. USE FOR: "secure storage", "SecureStorage", "store token securely", "Keychain", "Android Keystore", "save secret", "encrypted storage", "store credentials", "sensitive data storage". DO NOT USE FOR: general file storage (use maui-file-handling), SQLite databases (use maui-sqlite-database), or authentication flows (use maui-authentication).

intelligentcode-ai Skill

Activate when user needs security work - vulnerability assessment, security architecture, compliance audits, penetration testing. Activate when the security-engineer skill is requested or work requires security review.

kevinslin-skills Bundle

Audit a repo for code quality issues using focused heuristics.

kevinslin-skills Bundle

Audit documentation rewrites with JSON-first, block-scoped, line-level coverage mappings. Use for moved-section checklists, preservation proofs, migration maps, or line-by-line coverage reviews of Markdown/MDX docs.

kevinslin-skills Bundle

Create, fork, rename, audit, or close tracked Codex tasks. Always use when the user asks to spawn, create, or fork a new task, thread, chat, or conversation.

thkt Bundle

Two-phase challenge that judges whether a discovered problem is real and whether a proposed idea is usable. Phase 1 loops subagent verification and advisor judgment over evidence (OUTCOME.md + parallel subagents) to self-resolve design-tree branches. It asks the user only the irreversible branches that remain and proceeds on stated assumptions for the rest. Phase 2 spawns two critic-design subagents (internal attack / OUTCOME.md attack) as devil's advocate input. The verdict leads the output as a simple GO / NO-GO. Do NOT use for code review findings (use the audit workflow) or outcome assertion (use /assert which has built-in adversarial testing).

thkt Bundle

Silent failure detection. Do NOT use for security (use-context-reviewer-security) or readability (use-context-reviewer-readability).

thkt Bundle

OWASP Top 10 security review. Do NOT use for readability (use-context-reviewer-readability) or test design (use-context-reviewer-testability).

pr-pm Skill

Use when creating or publishing Claude Code hooks - covers executable format, event types, JSON I/O, exit codes, security requirements, and PRPM package structure

thkt Bundle

Code readability review. Do NOT use for security (use-context-reviewer-security), error handling (use-context-reviewer-silence), or test design (use-context-reviewer-testability).

thkt Bundle

Testable code design review. Do NOT use for security (use-context-reviewer-security) or readability (use-context-reviewer-readability).

trecek Skill

Create a validity threat matrix identifying alternative explanations and design mitigations. Adversarial lens answering "What alternative explanations survive?"

aeyeops Skill

Use when validating user input, handling a file upload, managing secrets, implementing authentication, handling authorization, encoding output, choosing cryptography, or applying secure defaults while writing code. Covers validation strategy and common validations, XSS prevention through output encoding and Content Security Policy, the secret storage hierarchy and what to do after a secret is exposed, password handling, JWT tokens and session management, role-based and resource-level access control, which cryptographic primitive to use when, and secure random number generation. For writing safe code; to audit existing code against the OWASP Top 10, use owasp-top-10.

biwakonbu Skill

Use when user wants to check secret protection, audit gitignore, scan for exposed secrets, or check security status. プロジェクトのシークレット保護状況をスキャン・監査し、.gitignore の漏れを検出し保護が必要なファイルを特定してレポートする。

biwakonbu Skill

Use when user wants to audit memory, check memory status, analyze memory configuration, or evaluate memory efficiency. Also use when user says 監査, チェック, 分析, 評価, 現状確認. メモリ構成の監査と分析を行い、現在のメモリ状態を評価し、最適化ポイントを特定する。

biwakonbu Skill

Use when user needs to work with secrets, manage environment variables, create secret loading scripts, or asks about secure credential management. シークレットファイルの安全な操作方法とベストプラクティスを提供し、テンプレートスクリプト生成や環境変数の安全な設定方法を案内する。

trecek Skill

Create Reproducibility Artifacts experimental design diagram showing run instructions, environment capture, data availability, determinism controls, and audit trail. Transparency lens answering "Could an independent party reproduce this?"

biwakonbu Skill

Use when user asks about Zero Trust, WAF, DDoS, Bot Management, SSL, TLS, Turnstile, Access, Gateway, or security configuration. Also use when user says セキュリティ, ゼロトラスト, WAF, DDoS, ボット対策, SSL, Turnstile. Cloudflare セキュリティ機能の完全ガイドで、Zero Trust、WAF、DDoS Protection、Bot Management、SSL/TLS、Turnstile の設定と使い方を提供する。

excatt Bundle

Run project-specific verification rules (business logic, architecture patterns, naming) that linters cannot catch; bootstraps rules if none exist. Not for build/lint/test (/verify).

ilang-ai Skill

Auto-apply security basics and block deploys that would leak secrets. Never ask the user about security choices — just do it, and run a real secret scan before going live.

thapaliyabikendra Skill

Web application security patterns including STRIDE threat modeling, OWASP Top 10 compliance, ABP authorization, and security audit procedures. Use when: (1) conducting security audits, (2) implementing authentication/authorization, (3) creating threat models, (4) reviewing code for vulnerabilities.

artsmc Bundle

Elite code review expert for Python. Focuses on Pythonic idioms, strict typing (MyPy), security (Bandit), and modern linting (Ruff).. Use when Codex needs this specialist perspective or review style.

artsmc Bundle

Security reviews, vulnerability scanning, OWASP compliance, and penetration testing guidance. Use when Codex needs this specialist perspective or review style.

artsmc Bundle

Elite code review expert for Python. Focuses on Pythonic idioms, strict typing (MyPy), security (Bandit), and modern linting (Ruff).. Use when Codex needs this specialist perspective or review style.

kubernetes-sigs-kueue Skill

Review a diff for security issues exploitable by a tenant, neighbouring controller, or malicious workload spec — input validation, injection, DoS, nil-safety, authz, info disclosure, supply chain, webhook safety.

kubernetes-sigs-kueue Skill

Evaluate the quality of a git diff between two commits by delegating per-skill analysis (Code Style, Buggy Behavior, Comments, Architectural Decisions, Security) to subagents, then aggregating their findings and recommendations into a scored report.

kubernetes-sigs-kueue Skill

Flag injection vectors from user-supplied strings — exec, SSRF, fmt.Sprintf-built selectors/URLs, template rendering, query concatenation (CWE-78, CWE-94, CWE-918).

artsmc Bundle

Automated security vulnerability scanning for Python and JavaScript/TypeScript codebases. Detects OWASP Top 10 vulnerabilities, hardcoded secrets, injection risks, and known CVEs with actionable remediation guidance.. Use when Codex should run the converted security-quality-assess workflow.

kubernetes-sigs-kueue Skill

Flag missing resource bounds / DoS resistance — uncapped loops or allocations, missing timeouts, reconciler-wedging input, unbounded metric cardinality (CWE-400, CWE-770).